[libvirt] [PATCH] BZ1072677: Avoid freeing of 0 file descriptor

[Stefan Berger]

From: Stefan Berger <stefanb at linux.vnet.ibm.com>

Avoid the freeing of an array of zero file descriptors in case
of error. Introduce a macro VIR_INIT_N_FD to initialize such
an array's elements to -1.

Signed-off-by: Stefan Berger <stefanb at linux.vnet.ibm.com>
---
 src/qemu/qemu_hotplug.c | 14 +++++++++++---
 src/util/virfile.h      | 12 ++++++++++++
 2 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
index 6703c92..b295db2 100644
--- a/src/qemu/qemu_hotplug.c
+++ b/src/qemu/qemu_hotplug.c
@@ -874,9 +874,12 @@ int qemuDomainAttachNetDevice(virConnectPtr conn,
         tapfdSize = vhostfdSize = net->driver.virtio.queues;
         if (!tapfdSize)
             tapfdSize = vhostfdSize = 1;
-        if (VIR_ALLOC_N(tapfd, tapfdSize) < 0 ||
-            VIR_ALLOC_N(vhostfd, vhostfdSize) < 0)
+        if (VIR_ALLOC_N(tapfd, tapfdSize) < 0)
             goto cleanup;
+        VIR_INIT_N_FD(tapfd, tapfdSize);
+        if (VIR_ALLOC_N(vhostfd, vhostfdSize) < 0)
+            goto cleanup;
+        VIR_INIT_N_FD(vhostfd, vhostfdSize);
         if (qemuNetworkIfaceConnect(vm->def, conn, driver, net,
                                     priv->qemuCaps, tapfd, &tapfdSize) < 0)
             goto cleanup;
@@ -885,8 +888,12 @@ int qemuDomainAttachNetDevice(virConnectPtr conn,
             goto cleanup;
     } else if (actualType == VIR_DOMAIN_NET_TYPE_DIRECT) {
         tapfdSize = vhostfdSize = 1;
-        if (VIR_ALLOC(tapfd) < 0 || VIR_ALLOC(vhostfd) < 0)
+        if (VIR_ALLOC(tapfd) < 0)
+            goto cleanup;
+        *tapfd = -1;
+        if (VIR_ALLOC(vhostfd) < 0)
             goto cleanup;
+        *vhostfd = -1;
         if ((tapfd[0] = qemuPhysIfaceConnect(vm->def, driver, net,
                                              priv->qemuCaps,
                                              VIR_NETDEV_VPORT_PROFILE_OP_CREATE)) < 0)
@@ -898,6 +905,7 @@ int qemuDomainAttachNetDevice(virConnectPtr conn,
         vhostfdSize = 1;
         if (VIR_ALLOC(vhostfd) < 0)
             goto cleanup;
+        *vhostfd = -1;
         if (qemuOpenVhostNet(vm->def, net, priv->qemuCaps, vhostfd, &vhostfdSize) < 0)
             goto cleanup;
     }
diff --git a/src/util/virfile.h b/src/util/virfile.h
index 20baf6f..802cf01 100644
--- a/src/util/virfile.h
+++ b/src/util/virfile.h
@@ -75,6 +75,18 @@ FILE *virFileFdopen(int *fdptr, const char *mode) ATTRIBUTE_RETURN_CHECK;
                  VIR_FILE_CLOSE_PRESERVE_ERRNO |    \
                  VIR_FILE_CLOSE_DONT_LOG))
 
+static inline void vir_init_n_int(int *ptr, int count, int value)
+{
+    int i;
+
+    for (i = 0; i < count; i++)
+        ptr[i] = value;
+}
+
+/* Initialize an array of file descriptors to -1 */
+# define VIR_INIT_N_FD(ptr, count) \
+    vir_init_n_int(ptr, count, -1)
+
 /* Opaque type for managing a wrapper around a fd.  */
 struct _virFileWrapperFd;
 
-- 
1.8.1.4